Work environment
| Questions |
Answers |
| System Capstone runs on OS/arch/bits |
macOS arm64 and Linux arm64, 64-bit |
| Capstone module affected |
M68K |
| Source of Capstone |
git clone |
| Version/git commit |
251c5bb4bc9bb92973e738ae3c5f4ef86f103356 on next |
Expected behavior
M68K base and memory-indirect displacements with the value INT32_MIN should format as -$80000000 without undefined behavior.
Actual behavior
The printer passes a signed 32-bit INT32_MIN displacement to abs(). Negating that value cannot be represented by int, and UBSan reports signed overflow in M68KInstPrinter.c.
This is also the root cause of public OSS-Fuzz issue 484248078, reported as a MemorySanitizer use-of-uninitialized-value in printAddressingMode.
Steps to reproduce the behavior
Build next with -DENABLE_ASAN=ON, then disassemble either input in M68K-040 mode:
47 f1 21 30 80 00 00 00
20 f0 ff ff 80 00 00 00 80 00 00 00
For example:
UBSAN_OPTIONS=halt_on_error=1 ./cstool m68k40 '20 f0 ff ff 80 00 00 00 80 00 00 00'
The expected output is:
move.l ([-$80000000], -$80000000), (a0)+
Work environment
git clone251c5bb4bc9bb92973e738ae3c5f4ef86f103356onnextExpected behavior
M68K base and memory-indirect displacements with the value
INT32_MINshould format as-$80000000without undefined behavior.Actual behavior
The printer passes a signed 32-bit
INT32_MINdisplacement toabs(). Negating that value cannot be represented byint, and UBSan reports signed overflow inM68KInstPrinter.c.This is also the root cause of public OSS-Fuzz issue 484248078, reported as a MemorySanitizer use-of-uninitialized-value in
printAddressingMode.Steps to reproduce the behavior
Build
nextwith-DENABLE_ASAN=ON, then disassemble either input in M68K-040 mode:For example:
UBSAN_OPTIONS=halt_on_error=1 ./cstool m68k40 '20 f0 ff ff 80 00 00 00 80 00 00 00'The expected output is: